Keep attribution consistent with vendor links

Three paths could leave a catalog row's attribution out of step with its
common_third_party_id. A FIRST_PARTY reclassification in the mapping
worker kept a stale org ThirdParty link instead of clearing it. The
upsert requeued terminal FIRST_PARTY rows for enrichment on a vendor
they never adopt, since the vendor-preservation clause nulls it. And the
proboctl upsert command did not normalize the verdict when an operator
linked or unlinked a vendor without passing --attribution.

Clear the org link on a first-party verdict, exclude FIRST_PARTY rows
from the enrichment requeue, and have the CLI downgrade THIRD_PARTY to
UNDETERMINED on unlink and promote UNDETERMINED to THIRD_PARTY on link.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/tracker_mapping_worker.go

@@ -215,6 +215,7 @@ func (h *trackerMappingHandler) Process(ctx context.Context, tp coredata.Tracker
 	commonPatternID := det.commonPatternID
 	commonThirdPartyID := det.commonThirdPartyID
 	directThirdPartyID := det.directThirdPartyID
+	firstParty := det.firstParty
 
 	// Phase 2: tracker-mapping agent (no transaction). It runs only when
 	// the deterministic signals could not resolve a catalog third party.
@@ -251,6 +252,7 @@ func (h *trackerMappingHandler) Process(ctx context.Context, tp coredata.Tracker
 
 					commonPatternID = firstNonNil(commonPatternID, match.commonPatternID)
 					commonThirdPartyID = match.commonThirdPartyID
+					firstParty = match.firstParty
 
 					return nil
 				},
@@ -265,7 +267,12 @@ func (h *trackerMappingHandler) Process(ctx context.Context, tp coredata.Tracker
 	// touches the database (in a short transaction).
 	thirdPartyID := tp.ThirdPartyID
 
-	if thirdPartyID == nil {
+	// A first-party verdict is terminal: the artifact has no vendor, so
+	// any org ThirdParty link a prior mapping run left on the pattern is
+	// stale and must be cleared.
+	if firstParty {
+		thirdPartyID = nil
+	} else if thirdPartyID == nil {
 		switch {
 		case directThirdPartyID != nil:
 			thirdPartyID = directThirdPartyID